Access Control (AC)
The Access Control family has 23 active controls in SP 800-53 release 5.2.0. “Yes” marks membership in the SP 800-53B baselines.
| Control | Title | Low | Moderate | High | Privacy |
|---|---|---|---|---|---|
| AC-1 | Policy and Procedures | Yes | Yes | Yes | Yes |
| AC-2 | Account Management | Yes | Yes | Yes | |
| AC-3 | Access Enforcement | Yes | Yes | Yes | |
| AC-4 | Information Flow Enforcement | Yes | Yes | ||
| AC-5 | Separation of Duties | Yes | Yes | ||
| AC-6 | Least Privilege | Yes | Yes | ||
| AC-7 | Unsuccessful Logon Attempts | Yes | Yes | Yes | |
| AC-8 | System Use Notification | Yes | Yes | Yes | |
| AC-9 | Previous Logon Notification | ||||
| AC-10 | Concurrent Session Control | Yes | |||
| AC-11 | Device Lock | Yes | Yes | ||
| AC-12 | Session Termination | Yes | Yes | ||
| AC-14 | Permitted Actions Without Identification or Authentication | Yes | Yes | Yes | |
| AC-16 | Security and Privacy Attributes | ||||
| AC-17 | Remote Access | Yes | Yes | Yes | |
| AC-18 | Wireless Access | Yes | Yes | Yes | |
| AC-19 | Access Control for Mobile Devices | Yes | Yes | Yes | |
| AC-20 | Use of External Systems | Yes | Yes | Yes | |
| AC-21 | Information Sharing | Yes | Yes | ||
| AC-22 | Publicly Accessible Content | Yes | Yes | Yes | |
| AC-23 | Data Mining Protection | ||||
| AC-24 | Access Control Decisions | ||||
| AC-25 | Reference Monitor |
Withdrawn controls: AC-13, AC-15.
Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.